dalao.ai

PocketBase

Open-source backend in one file: SQLite, auth, files, realtime and an admin dashboardOpen source

About PocketBase

PocketBase is an open-source Go backend whose single executable bundles a SQLite database, realtime subscriptions, user and file management and a web dashboard. As of 2026-10-26 the mainline is at v0.40.6, released 2026-10-23 19:21 (UTC+8); the v0.22.x maintenance line, which only gets backported fixes, is at v0.22.57. The code is MIT-licensed, with no official hosting. The FAQ says it is a personal project with no paid team or company behind it. The project has announced plans to publish new versions only on the author's self-hosted ganigeorgiev.com and to archive the GitHub repositories.

EditorialUpdated 8 min read

The PocketBase interface

What problem it solves

Many small apps need roughly the same backend: a database, sign-up and login, file uploads, pushing data changes to the frontend, and an admin screen for browsing and editing records. A hosted service bills by usage; building it in-house means deploying a database, an auth service and object storage separately. PocketBase packs all of it into one executable. Download it, extract it and start ./pocketbase serve, and a REST-ish API and a web dashboard are up.

It is also a regular Go library. Business logic can live in a Go program of its own and still compile into one portable file, and the prebuilt executable embeds a JavaScript engine for server-side extensions written in JS. Official client SDKs exist for JavaScript and Dart.

The same repository ships two lines in parallel:

  • Mainline v0.40.x: as of 2026-10-26 the latest is v0.40.6, released 2026-10-23 19:21 (UTC+8). The mainline has not reached 1.0.
  • Maintenance line v0.22.x: the latest is v0.22.57, released 2026-10-23 19:19 (UTC+8). v0.23.0, released 2024-11-24 22:50 (UTC+8), was a major refactor with many breaking changes to the Go, JS and Web APIs; its release notes said users not planning further development on existing apps did not have to upgrade, and that critical bug and security fixes would be backported to v0.22.x. All three changes in v0.22.57 are marked as backported from v0.40.6.
  • The first public release, v0.1.0, came out 2022-07-07 10:58 (UTC+8); GitHub holds close to 300 releases.

The author is Gani Georgiev: the MIT license reads Copyright (c) 2022 - present, Gani Georgiev, and the GitHub account ganigeorgiev maintains the repository and is its top contributor by commits. The FAQ describes PocketBase as a personal open-source project with intentionally limited scope, developed entirely on a volunteer basis (as reported by the vendor).

On 2026-09-12 14:53 (UTC+8) the author announced in GitHub Discussions that all repositories would move to a self-hosted platform at ganigeorgiev.com, with no GitHub mirror. v0.40.6 switches the built-in update command to fetch new versions from the new host; in discussion #7841 the author wrote that once the move happens, "new releases will be available ONLY on the new host ganigeorgiev.com/pocketbase/pocketbase".

PocketBase is neither a startup, nor a business. There is no paid team or company behind it.

PocketBase FAQ

Core capabilities

One file is the whole dependency list. The minimal setup in the deployment guide is to upload the executable plus the pb_migrations and pb_hooks directories and start it; passing a domain name makes it obtain an HTTPS certificate from Let's Encrypt automatically.

The data layer is embedded SQLite in WAL mode. Collections come in three types: Base for ordinary app data, View for a read-only collection built from an SQL SELECT, and Auth for collections with built-in user authentication. Each collection has five API rules for list, view, create, update and delete; the rules are filter expressions, so they govern both access and which records are visible, and an unset rule means only superusers can perform the action.

Authentication covers passwords, one-time email codes (OTP) and more than 15 OAuth2 providers, with optional multi-factor authentication that requires two different methods. The API is stateless: tokens are not stored on the server and no logout endpoint exists. Superusers can impersonate any user to issue tokens.

Files can live on local disk or in S3-compatible storage; image fields can serve thumbnails at set sizes, and protected files require a short-lived file token. Realtime updates run over Server-Sent Events, and each collection's view and list rules decide who receives create, update and delete events.

Extensions take two routes, Go or JS. The docs call Go the primary language with fuller API documentation; the embedded JS engine, goja, wraps the Go APIs, keeps a prewarmed pool of 15 runtimes, and reloads automatically when .pb.js files in pb_hooks change.

Operational features sit in the dashboard too: built-in backup and restore since v0.16, stored locally or in S3-compatible storage, with backups no longer holding a database transaction lock since v0.40.0; a built-in rate limiter since v0.23.0; and a superuser IP allowlist since v0.38.0.

Who uses it

As of 2026-10-26, pocketbase/pocketbase on GitHub has about 62,000 stars and about 3,700 forks, and the repository was created on 2022-07-05.

The FAQ names typical uses as small and midsize apps that fit on one server: SaaS products, mobile app backends and intranets. On performance, the FAQ says that even without optimizations PocketBase can serve more than 10,000 persistent realtime connections on a small two-vCPU, 4GB Hetzner CAX11 server (as reported by the vendor), and a separate pocketbase/benchmarks repository lists results for various read and write operations. As of 2026-10-26, Hetzner's price list shows the CAX11 from €6.49 a month, excluding VAT.

In the migration discussion the author wrote that close to 300 GitHub releases, more than 25GB of files, will not move to the new platform, and that many people still run older releases such as v0.22.x, which is why the maintenance line keeps receiving critical fixes. The author also wrote that popularity has no value for the project, and that a smaller but more constructive community would be a welcome trade.

How it compares

Firebase and Supabase are the two backends PocketBase is most often set against. Custom server-side logic on Firebase is written as Cloud Functions, and deploying them requires upgrading the project to the usage-billed Blaze plan. PocketBase has no cloud functions; custom logic comes from extending PocketBase itself as a Go or JS framework.

Supabase is built around Postgres and can also be self-hosted; the self-hosted version runs a set of services with Docker Compose behind one API gateway for REST, auth, storage and realtime. PocketBase uses only embedded SQLite, the FAQ rules out plans to support other databases, and a deployment is one process plus a pb_data directory.

Scaling differs as well. The FAQ says PocketBase scales only vertically, on a single server.

Who it's for / Not for

Suited to solo developers and small teams building the backend for a single-page app, a mobile app or an internal tool: data, auth, files and realtime updates sit in one file, and the frontend talks to the API through the official SDKs.

Suited to Go developers who want business logic and the backend compiled into one binary, and to people writing only a little server-side code who want quick prototypes with JS hooks; the docs say JS code can be moved to Go gradually later.

Suited to those comfortable running their own server: one VPS with persistent storage is enough.

Not suited to projects that need horizontal scaling across several servers, another database such as Postgres or MySQL, or cloud functions.

Not suited to teams that need a stable API commitment or a commercial support contract: backward compatibility is not guaranteed before 1.0, and no paid support is offered.

Not suited to anyone planning to rely entirely on AI tools without reading the docs (as the FAQ states).

Getting started

As of 2026-10-26, prebuilt executables are downloaded from GitHub Releases for several architectures on macOS, Linux and Windows. After extracting, ./pocketbase serve prints the dashboard address in the terminal; the first superuser is set up in the browser, followed by collections and their API rules.

Frontends can use the official JavaScript SDK for browsers, Node.js and React Native, or the Dart SDK for web, mobile, desktop and CLI. For web apps, the docs recommend a client-side single-page frontend, with Go or JS extensions handling server-side needs such as payment webhooks or extra validation.

For production, the deployment guide includes examples for a systemd service, NGINX and Caddy reverse proxies, and Docker. It marks SMTP mail, the rate limiter and a superuser IP allowlist as highly recommended. No official Docker image exists; the sample Dockerfile downloads the v0.40.6 archive from GitHub Releases, and the /pb/pb_data directory has to be mounted as a persistent volume.

Once the migration is done, new versions will be published only at ganigeorgiev.com/pocketbase/pocketbase, and Go code targeting newer versions has to swap github.com/pocketbase imports for ganigeorgiev.com/pocketbase.

Pricing & license

PocketBase is free and open source under the MIT license; the README says anyone may do whatever they want with it, including offering it as a paid service.

No official hosting is offered, so the cost is the server it runs on. The FAQ lists free tiers from Google Cloud and Oracle Cloud and VPS providers such as Hetzner and Vultr, and uses a Hetzner CAX11 at about $4 a month as its performance reference; as of 2026-10-26, Hetzner's price list shows the CAX11 from €6.49 a month, excluding VAT.

The project does not accept individual donations. The FAQ explains that personal donations tend to come with unspoken expectations; organizations offering sponsorships or grants with no strings attached can write to support@pocketbase.io.

Risks & limits

The release channel is changing. Under the 2026-09-12 migration announcement, the GitHub repositories will be archived, development moves to ganigeorgiev.com with no official mirror, and old release files stay on GitHub. In the discussion the author set the move for 2026-10-26; as of 2026-10-26 04:32 (UTC+8) the ganigeorgiev.com home page still serves only a placeholder message and no releases. GitHub watchers will not be migrated automatically.

It has not reached 1.0. The README warns that full backward compatibility is not guaranteed before v1.0.0; v0.40.0 changed the exit code of failing console commands.

Maintenance rests on one person. The FAQ makes no promise of maintenance or support beyond what exists, and the roadmap has no fixed dates; the author says backports to v0.22.x continue only while they do not cause too much work.

Operations are self-managed. Backups can use the built-in feature or a copy of pb_data, but they slow queries on larger datasets, and for 5GB and above the docs point to sqlite3 .backup plus rsync instead; for replication and disaster recovery the FAQ suggests Litestream. App settings, including SMTP passwords and S3 credentials, are stored as plain JSON in the database unless the --encryptionEnv flag is used.

The v0.40.6 release notes state that thumbnail generation remains one of the main sources of out-of-memory crashes, and the new pixel cap is only a mitigation. JS extensions run on goja, which is not fully ES6-compliant, handlers cannot use setTimeout, and compute-heavy pure JS code runs slower.

Outside contributions are restricted. Because of LLM spam, the README says only existing collaborators can open pull requests and LLM-generated contributions are not welcome; the new platform has no pull requests, and code suggestions arrive as patch attachments in discussions.

Our verdict

What sets PocketBase apart: a single executable that bundles a SQLite database, auth, file storage, realtime subscriptions and a dashboard; extensibility as a Go library or through JS hooks; and an MIT license with no official hosting.

Its limits: vertical scaling only, with embedded SQLite as the only database; no backward-compatibility guarantee before 1.0; maintenance by one volunteer with no paid support; and a release channel moving from GitHub to ganigeorgiev.com.

Why it stands out

PocketBase is a backend in a single file. Download one binary and you have a SQLite database, authentication, file storage, realtime subscriptions, and an admin dashboard, ready for a side project or a company that never wants to run Postgres.

Gani Georgiev maintains it alone, answers issues himself, and has kept the scope tight for years.

One binary provides a SQLite database, authentication, file storage, realtime subscriptions and an admin dashboard, and one person maintains it.

Sources

Official

  1. PocketBase READMEGitHub · Accessed Oct 26, 2026
  2. PocketBase - Open Source backend in 1 filepocketbase.io · Accessed Oct 26, 2026
  3. PocketBase FAQpocketbase.io · Accessed Oct 26, 2026
  4. Going to production - PocketBase docspocketbase.io · Accessed Oct 26, 2026
  5. Authentication - PocketBase docspocketbase.io · Accessed Oct 26, 2026
  6. API rules and filters - PocketBase docspocketbase.io · Accessed Oct 26, 2026
  7. Collections - PocketBase docspocketbase.io · Accessed Oct 26, 2026
  8. Files upload and handling - PocketBase docspocketbase.io · Accessed Oct 26, 2026

Updates & reading